Sign in

Capstone Technologies Group

@captechgroup.com
34 followers 27 following 431 posts

Veteran-owned managed IT & cybersecurity for Ohio medical, legal & financial firms. Springfield-based since 2004. SonicWall Certified · N-able Partner. Threat patterns and practical security guidance for professional practices—what we're actually seeing.

PostsRepliesMedia
Capstone Technologies Group @captechgroup.com · 10/10/2026
The FBI arrested the co-founder of a ransomware negotiation firm on extortion charges tied to ShinyHunters. The people you hire to talk to attackers may know more about your breach than your own staff do. #infosec #cybersecurity
captechgroup.com
FBI Arrests Founder of Ransomware Negotiation Firm Tied to ShinyHunters
The FBI arrested the co-founder of a ransomware negotiation firm on extortion charges tied to ShinyHunters. The people you hire to talk to attackers may know more about your breach than your own staff do. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 09/10/2026
An affiliate forked off from Gentlemen ransomware, stood up his own leak site, and pocketed the payouts — proof that brand-based detection has a very short shelf life. #infosec #cybersecurity
captechgroup.com
Ransomware Affiliate Betrayal, WhatsApp RAT and Exposed Hacker Tools Roundup
An affiliate forked off from Gentlemen ransomware, stood up his own leak site, and pocketed the payouts — proof that brand-based detection has a very short shelf life. #infosec #cybersecurity
010
Capstone Technologies Group @captechgroup.com · 08/10/2026
Under 24 minutes and about a dollar to build a working phishing site. AiTM kits relay the real Microsoft login, pass the real MFA prompt, and steal the session token. The gateway has nothing to inspect. #infosec #cybersecurity
captechgroup.com
Phishing Defense Fails When Email Controls Target the Wrong Layer
Under 24 minutes and about a dollar to build a working phishing site. AiTM kits relay the real Microsoft login, pass the real MFA prompt, and steal the session token. The gateway has nothing to inspect. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 07/10/2026
86,644 working Fortinet credentials, 194 countries, and a firmware update doesn't revoke a single one. FortiBleed is still live — rotation, not patching, is what closes the door. #infosec #cybersecurity
captechgroup.com
FBI Warns FortiBleed Still Active After Stealing 86,644 Fortinet Credentials
86,644 working Fortinet credentials, 194 countries, and a firmware update doesn't revoke a single one. FortiBleed is still live — rotation, not patching, is what closes the door. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 06/10/2026
TA419 impersonated named US policy officials, exchanged several real messages with AI experts before sending any link, then landed them on a frameless browser-in-the-browser page that relayed MFA in real time. #infosec #cybersecurity
captechgroup.com
TA419 Impersonates US Officials Using Frameless BitB for AI Espionage
TA419 impersonated named US policy officials, exchanged several real messages with AI experts before sending any link, then landed them on a frameless browser-in-the-browser page that relayed MFA in real time. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 03/10/2026
Stolen credentials are cheaper for attackers than software exploits, and non-human identities rarely sit behind MFA. A look at the ten segments shaping 2026 security budgets. #infosec #cybersecurity
captechgroup.com
The State of Cybersecurity in 2026 Key Segments, Insights, and Innovations
Stolen credentials are cheaper for attackers than software exploits, and non-human identities rarely sit behind MFA. A look at the ten segments shaping 2026 security budgets. #infosec #cybersecurity
110
Capstone Technologies Group @captechgroup.com · 02/10/2026
Microsoft's X account, 13M followers, got hijacked to push a Clippy crypto token. Verified badge, right handle, clean follower count, and still attacker-controlled. A trusted brand handle is a delivery channel. #infosec #cybersecurity
captechgroup.com
Crypto Scammers Hijack Microsoft's Official X Account in Infostealer Campaign
Microsoft's X account, 13M followers, got hijacked to push a Clippy crypto token. Verified badge, right handle, clean follower count, and still attacker-controlled. A trusted brand handle is a delivery channel. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 01/10/2026
Two healthcare breach notices, same day, neither started with a hospital network. A law firm's compromise exposed patient data from Arrowhead Regional Medical Center — proof that your vendor's server is your exposure too. #infosec #cybersecurity
captechgroup.com
Saber Healthcare and Buchalter Disclose Separate Data Breach Incidents
Two healthcare breach notices, same day, neither started with a hospital network. A law firm's compromise exposed patient data from Arrowhead Regional Medical Center — proof that your vendor's server is your exposure too. #infosec #cybersecurity
111
Capstone Technologies Group @captechgroup.com · 30/09/2026
CSuite phishing steals live Microsoft 365 sessions and installs ScreenConnect on the same victim. MFA passes, the token gets replayed, and a signed RMM agent keeps the foothold. One email, two compromises. #infosec #cybersecurity
captechgroup.com
CSuite Phishing Steals Microsoft 365 Sessions and Deploys ScreenConnect RMM
CSuite phishing steals live Microsoft 365 sessions and installs ScreenConnect on the same victim. MFA passes, the token gets replayed, and a signed RMM agent keeps the foothold. One email, two compromises. #infosec #cybersecurity
001
Capstone Technologies Group @captechgroup.com · 29/09/2026
Cisco Talos IR now monitors up to 10 named executive identities monthly, because a single malicious inbox rule on a CFO account disappears in a 10,000-endpoint tenant. #infosec #cybersecurity
captechgroup.com
Executive Threat Detection Extends Account Monitoring to Leadership Credentials
Cisco Talos IR now monitors up to 10 named executive identities monthly, because a single malicious inbox rule on a CFO account disappears in a 10,000-endpoint tenant. #infosec #cybersecurity
011
Capstone Technologies Group @captechgroup.com · 26/09/2026
AI agents bill by the loop. A prompt like "question your own reasoning from every possible angle" passes every input filter and burns thinking tokens all day. Forcepoint calls it denial of wallet. #infosec #cybersecurity
captechgroup.com
AI Agents Trigger Runaway Costs for Enterprises Running Automated Workflows
AI agents bill by the loop. A prompt like "question your own reasoning from every possible angle" passes every input filter and burns thinking tokens all day. Forcepoint calls it denial of wallet. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 25/09/2026
Attackers are seeding the open web so ChatGPT, Gemini, and Google AI Overviews hand users fake Chase and Delta support numbers, no phishing email required. Plus a VS Code flaw that beats Workspace Trust. #infosec #cybersecurity
captechgroup.com
ThreatsDay Roundup Covers AI Search Poisoning and One-Click Code Execution
Attackers are seeding the open web so ChatGPT, Gemini, and Google AI Overviews hand users fake Chase and Delta support numbers, no phishing email required. Plus a VS Code flaw that beats Workspace Trust. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 24/09/2026
Corp MDM poses as a carrier's device management app, hides its icon, steals every inbound SMS, and switches on unconditional call forwarding. Both channels carry account verification codes. Logistics is the target. #infosec #cybersecurity
captechgroup.com
Diesel Vortex Deploys Corp MDM Spyware That Steals SMS and Redirects Calls
Corp MDM poses as a carrier's device management app, hides its icon, steals every inbound SMS, and switches on unconditional call forwarding. Both channels carry account verification codes. Logistics is the target. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 23/09/2026
Microsoft seized 50 sites tied to EvilTokens, a $500/month phishing service that stole Microsoft 365 session tokens via OAuth device code abuse — then used an AI chatbot to read mailboxes and draft invoice fraud. #infosec #cybersecurity
captechgroup.com
Microsoft Disrupts EvilTokens Operation Behind AI-Powered Cybercrime
Microsoft seized 50 sites tied to EvilTokens, a $500/month phishing service that stole Microsoft 365 session tokens via OAuth device code abuse — then used an AI chatbot to read mailboxes and draft invoice fraud. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 22/09/2026
Cisco Talos found a Windows implant with no C2 server: CLOSEDQUORUM polls four commercial LLMs, takes a plurality vote, and runs the winning action. No domain to block. #infosec #cybersecurity
captechgroup.com
CLOSEDQUORUM and CAIRN Mark the First Reported Autonomous AI C2 Implant
Cisco Talos found a Windows implant with no C2 server: CLOSEDQUORUM polls four commercial LLMs, takes a plurality vote, and runs the winning action. No domain to block. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 19/09/2026
Attackers don't need a password if a user clicks Approve. OAuth consent abuse hands over tokens through a real provider login screen, and MFA never enters the picture again. #infosec #cybersecurity
captechgroup.com
OAuth Consent Abuse Bypasses MFA Through Third-Party App Permissions
Attackers don't need a password if a user clicks Approve. OAuth consent abuse hands over tokens through a real provider login screen, and MFA never enters the picture again. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 18/09/2026
Oracle patched 800+ flaws with zero flagged as exploited — meanwhile ransomware crews are hitting a vCenter bug fixed back in July. Patch volume isn't the same as risk. #infosec #cybersecurity
captechgroup.com
ThreatsDay Tracks 800+ Patched Flaws, Insider SIM Swaps and Insomnia RAT
Oracle patched 800+ flaws with zero flagged as exploited — meanwhile ransomware crews are hitting a vCenter bug fixed back in July. Patch volume isn't the same as risk. #infosec #cybersecurity
010
Capstone Technologies Group @captechgroup.com · 17/09/2026
A fake AI trading bot installs Needle Stealer, which replaces your MetaMask extension with a pixel-perfect fake and mails the password to the operator. Delivery starts with a Microsoft-signed binary side-loading a DLL. #infosec #cybersecurity
captechgroup.com
Fake AI Trading Agent Steals Crypto Wallet Passwords and Deploys XWorm
A fake AI trading bot installs Needle Stealer, which replaces your MetaMask extension with a pixel-perfect fake and mails the password to the operator. Delivery starts with a Microsoft-signed binary side-loading a DLL. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 16/09/2026
zHealth, a cloud EHR provider, says an attacker was in its network for about one day in January. It took until September to finish reviewing the data, and 118,563 people are affected. #infosec #cybersecurity
captechgroup.com
xHealth Discloses Data Breach Affecting 118,000 Individuals
zHealth, a cloud EHR provider, says an attacker was in its network for about one day in January. It took until September to finish reviewing the data, and 118,563 people are affected. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 15/09/2026
A spear-phishing link to a real .edu site used reflected XSS to bounce NGO staff into a three-bug Chrome and Windows zero-day chain ending in the GRIMWEDGE backdoor. No attachment, no macro, one click. #infosec #cybersecurity
captechgroup.com
China-Linked APT31 Exploits Chrome and Windows Zero-Day Chain to Deploy GRIMWEDGE
A spear-phishing link to a real .edu site used reflected XSS to bounce NGO staff into a three-bug Chrome and Windows zero-day chain ending in the GRIMWEDGE backdoor. No attachment, no macro, one click. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 12/09/2026
Intezer found 73,000 AI-tool alerts inside 16.9M enterprise SOC events, up 685% in five months, and 94.1% of them were noise generated by developers doing ordinary work. #infosec #cybersecurity
captechgroup.com
Enterprise AI Adoption Reshapes SOC Detection for Claude, Codex and Cursor
Intezer found 73,000 AI-tool alerts inside 16.9M enterprise SOC events, up 685% in five months, and 94.1% of them were noise generated by developers doing ordinary work. #infosec #cybersecurity
011
Capstone Technologies Group @captechgroup.com · 11/09/2026
Microsoft spotted more than a million emails impersonating executives at the recipients' own companies, with a fake ServiceNow invoice rendered inline. No link, no attachment, and SPF, DKIM and DMARC all pass. #infosec #cybersecurity
captechgroup.com
AI-Assisted Executive Impersonation Fuels Invoice Fraud at Organizations
Microsoft spotted more than a million emails impersonating executives at the recipients' own companies, with a fake ServiceNow invoice rendered inline. No link, no attachment, and SPF, DKIM and DMARC all pass. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 10/09/2026
Barracuda found a phishing campaign with no phishing page: the login form is built inside the victim's browser from a blob URL, reached through real Microsoft OAuth and Teams redirects. Blocklists have nothing to match. #infosec #cybersecurity
captechgroup.com
Attackers Build Phishing Pages That Exist Only Inside Victims' Browsers
Barracuda found a phishing campaign with no phishing page: the login form is built inside the victim's browser from a blob URL, reached through real Microsoft OAuth and Teams redirects. Blocklists have nothing to match. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 09/09/2026
Microsoft's September 2026 Patch Tuesday: 999 CVEs, 723 of them in Windows, and two zero-days already under active exploitation — one with no fix for Windows 11 or Server 2025. #infosec #cybersecurity
captechgroup.com
September 2026 Patch Tuesday Addresses 33 CVEs Including CVE-2026-58611
Microsoft's September 2026 Patch Tuesday: 999 CVEs, 723 of them in Windows, and two zero-days already under active exploitation — one with no fix for Windows 11 or Server 2025. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 08/09/2026
ClickFix without PowerShell: paste JavaScript into Chrome's address bar or a Tampermonkey userscript, and a browser-resident skimmer rewrites crypto deposit addresses. The C2 is a published Google Sheet. #infosec #cybersecurity
captechgroup.com
ClickFix Moves Into the Browser With Tampermonkey Cryptocurrency Theft
ClickFix without PowerShell: paste JavaScript into Chrome's address bar or a Tampermonkey userscript, and a browser-resident skimmer rewrites crypto deposit addresses. The C2 is a published Google Sheet. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 05/09/2026
ShinyHunters vishes your helpdesk for an MFA reset, logs into your SSO dashboard, and lets it inventory every app holding patient records. No malware, no ransom note, just a bill for the data. #infosec #cybersecurity
captechgroup.com
Health-ISAC Warns ShinyHunters Steals Healthcare Data in Rising Attacks
ShinyHunters vishes your helpdesk for an MFA reset, logs into your SSO dashboard, and lets it inventory every app holding patient records. No malware, no ransom note, just a bill for the data. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 05/09/2026
A trojanized Exodus Wallet installer runs the real app with the window hidden while a modular RAT quietly harvests Chrome, Edge and Firefox credentials. Zero of 76 VirusTotal engines flagged it. #infosec #cybersecurity
captechgroup.com
Trojanized Exodus Wallet Installer Delivers Modular RAT via ClickFix Lure
A trojanized Exodus Wallet installer runs the real app with the window hidden while a modular RAT quietly harvests Chrome, Edge and Firefox credentials. Zero of 76 VirusTotal engines flagged it. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 29/08/2026
Brave 1.94 gives every signup its own disposable email address, which kills hashed-email matching for adtech, and quietly breaks helpdesk verification and breach-feed matching too. #infosec #cybersecurity
captechgroup.com
Brave Browser Adds Email Aliases That Help Users Evade Tracking
Brave 1.94 gives every signup its own disposable email address, which kills hashed-email matching for adtech, and quietly breaks helpdesk verification and breach-feed matching too. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 29/08/2026
206 vulnerabilities in Microsoft's June 2026 update, 32 critical, 28 of those remote code execution. CVE-2026-47291 in http.sys needs no credentials and no user interaction. Talos published Snort coverage. #infosec #cybersecurity
captechgroup.com
Microsoft Patch Tuesday June 2026 Fixes Prominent Vulnerabilities With Snort Rules
206 vulnerabilities in Microsoft's June 2026 update, 32 critical, 28 of those remote code execution. CVE-2026-47291 in http.sys needs no credentials and no user interaction. Talos published Snort coverage. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 29/08/2026
A stolen session token has already passed MFA — replaying it in the attacker's browser produces a logged-in session with no prompt. That's why ClickFix ends up in your identity provider, not just your endpoints. #infosec #cybersecurity
captechgroup.com
Identity Hardening Controls That Blunt ClickFix and Credential Abuse
A stolen session token has already passed MFA — replaying it in the attacker's browser produces a logged-in session with no prompt. That's why ClickFix ends up in your identity provider, not just your endpoints. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 29/08/2026
Berlin traced data leaving a Senate department on Aug 7 and cut it off on Aug 14. Rhysida's leak site now claims 5.79TB. The city says it won't pay. #infosec #cybersecurity
captechgroup.com
Rhysida Ransomware Hits Berlin State Network as City Refuses to Pay
Berlin traced data leaving a Senate department on Aug 7 and cut it off on Aug 14. Rhysida's leak site now claims 5.79TB. The city says it won't pay. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 28/08/2026
No CVE, no phishing. DPRK IT workers get hired, badged and issued a laptop, then chain Astrill VPN over an IPRoyal proxy and plug in a PiKVM for hardware-level control. Peak account activity: midnight UTC. #infosec #cybersecurity
captechgroup.com
DPRK IT Workers Tied to FAMOUS CHOLLIMA Use Astrill VPN and IPRoyal Proxy
No CVE, no phishing. DPRK IT workers get hired, badged and issued a laptop, then chain Astrill VPN over an IPRoyal proxy and plug in a PiKVM for hardware-level control. Peak account activity: midnight UTC. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 28/08/2026
19 malicious Chrome and Edge extensions stole wallet keys and drained crypto, and five of them were legitimate tools the operator bought from their developers and poisoned in an update. #infosec #cybersecurity
captechgroup.com
19 Malicious Chrome and Edge Extensions Steal Wallet Data and Drain Crypto
19 malicious Chrome and Edge extensions stole wallet keys and drained crypto, and five of them were legitimate tools the operator bought from their developers and poisoned in an update. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 28/08/2026
A user installed a cracked ScreenConnect client in February. The attacker didn't log in until July. Signed vendor binaries, vendor-hosted relays, and no exploit needed. #infosec #cybersecurity
captechgroup.com
Attackers Abuse AnyDesk and ScreenConnect RMM Tools for Remote Access
A user installed a cracked ScreenConnect client in February. The attacker didn't log in until July. Signed vendor binaries, vendor-hosted relays, and no exploit needed. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 28/08/2026
One AI assistant was the attacker. Another was the open door. GTG-1002 drove Claude Code against ~30 orgs; EchoLeak turned a single email into zero-click exfiltration from Microsoft 365 Copilot. #infosec #cybersecurity
captechgroup.com
GTG-1002 Abuses Claude Code While EchoLeak Hits Microsoft 365 Copilot
One AI assistant was the attacker. Another was the open door. GTG-1002 drove Claude Code against ~30 orgs; EchoLeak turned a single email into zero-click exfiltration from Microsoft 365 Copilot. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 27/08/2026
Australian police arrested two alleged TeamPCP members over supply-chain attacks that reportedly hit 1,000+ organisations, stole 500,000 credentials and moved 300GB of data through poisoned build dependencies. #infosec #cybersecurity
captechgroup.com
Australia Arrests Alleged TeamPCP Hackers Behind Supply-Chain Attacks
Australian police arrested two alleged TeamPCP members over supply-chain attacks that reportedly hit 1,000+ organisations, stole 500,000 credentials and moved 300GB of data through poisoned build dependencies. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 27/08/2026
Three dark web storefronts account for 81.5% of the executive SSN exposures Rapid7 tracked in 2026. Xilo charges $0.25 per record, and the free search that confirms you've found the right CFO costs nothing. #infosec #cybersecurity
captechgroup.com
Identity-as-a-Service Markets Sell Executive SSNs Through Bankomat and Xilo
Three dark web storefronts account for 81.5% of the executive SSN exposures Rapid7 tracked in 2026. Xilo charges $0.25 per record, and the free search that confirms you've found the right CFO costs nothing. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 27/08/2026
Attackers are loading a legitimate signed OPSWAT AppRemover driver (CVE-2026-36425) to kill Defender from the kernel, then dropping Spark RAT on a host with no working sensors. #infosec #cybersecurity
captechgroup.com
Spark RAT Campaign Abuses OPSWAT ardrv.sys Driver to Kill Security Tools
Attackers are loading a legitimate signed OPSWAT AppRemover driver (CVE-2026-36425) to kill Defender from the kernel, then dropping Spark RAT on a host with no working sensors. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 27/08/2026
["ht","tps","://"].join("") is how a phishing kit keeps its exfiltration endpoint out of your string searches. JavaScript obfuscation stopped being a party trick and became a checkbox in the build process. #infosec #cybersecurity
captechgroup.com
JavaScript Obfuscation Evolves From Party Trick Into Phishing Kit Tooling
["ht","tps","://"].join("") is how a phishing kit keeps its exfiltration endpoint out of your string searches. JavaScript obfuscation stopped being a party trick and became a checkbox in the build process. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 26/08/2026
A fake CoinDesk exec DM'd DEF CON attendees a Google Doc. The Apps Script sidebar claimed it was encrypted, the key was rigged to fail, and the "fix" installed AMOS stealer on macOS with a LaunchDaemon backdoor. #infosec #cybersecurity
captechgroup.com
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver AMOS Stealer
A fake CoinDesk exec DM'd DEF CON attendees a Google Doc. The Apps Script sidebar claimed it was encrypted, the key was rigged to fail, and the "fix" installed AMOS stealer on macOS with a LaunchDaemon backdoor. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 26/08/2026
Microsoft found attackers hitting AI gateways, not models: two chained LiteLLM flaws gave shell access inside the proxy holding every provider API key, then dropped XMRig. #infosec #cybersecurity
captechgroup.com
LiteLLM Gateway Flaws Let Attackers Deploy XMRig on AI Infrastructure
Microsoft found attackers hitting AI gateways, not models: two chained LiteLLM flaws gave shell access inside the proxy holding every provider API key, then dropped XMRig. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 26/08/2026
Fake recruiters are phishing corporate logins on mobile, where there's no address bar to check. The kit even rejects personal email addresses — only company credentials get through to the password field. #infosec #cybersecurity
captechgroup.com
Fake Recruiter Phishing Targets Corporate Credentials on Mobile Devices
Fake recruiters are phishing corporate logins on mobile, where there's no address bar to check. The kit even rejects personal email addresses — only company credentials get through to the password field. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 26/08/2026
SLEEPWALKER is a Windows backdoor with no domains, no IPs, and no outbound connections. It poses as dpapi.dll, side-loads into ESET's agent, and sits idle until one crafted packet arrives. #infosec #cybersecurity
captechgroup.com
SLEEPWALKER Backdoor Hides in dpapi.dll and Runs Bytecode on One Packet
SLEEPWALKER is a Windows backdoor with no domains, no IPs, and no outbound connections. It poses as dpapi.dll, side-loads into ESET's agent, and sits idle until one crafted packet arrives. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 25/08/2026
Doubloon Dredger sends phishing from Notion's own servers, so SPF, DKIM and DMARC all pass. The payload is a device code page that harvests Microsoft tokens — no password typed, MFA completed by the victim. #infosec #cybersecurity
captechgroup.com
Doubloon Dredger Abuses Notion to Harvest Authentication Tokens
Doubloon Dredger sends phishing from Notion's own servers, so SPF, DKIM and DMARC all pass. The payload is a device code page that harvests Microsoft tokens — no password typed, MFA completed by the victim. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 25/08/2026
Two CISA red team assessments, two sectors, two SOCs. One quarantined hosts in under 10 minutes and still lost the entire AD graph. Directory enumeration looks exactly like normal LDAP traffic. #infosec #cybersecurity
captechgroup.com
Red Team Assessments Compare Two SOCs and BloodHound Detection Gaps
Two CISA red team assessments, two sectors, two SOCs. One quarantined hosts in under 10 minutes and still lost the entire AD graph. Directory enumeration looks exactly like normal LDAP traffic. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 25/08/2026
Mirage2FA proxies Microsoft's real 365 login page, passes the 2FA challenge straight through, and walks off with the session cookie. 4,532 org domains touched, 48% of targeted addresses potentially compromised. #infosec #cybersecurity
captechgroup.com
Mirage2FA Abuses Microsoft 365 Login Flows at 4,500 US and EU Companies
Mirage2FA proxies Microsoft's real 365 login page, passes the 2FA challenge straight through, and walks off with the session cookie. 4,532 org domains touched, 48% of targeted addresses potentially compromised. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 25/08/2026
Fake CAPTCHA, one clipboard paste into the Run dialog, and WordlistLoader delivers Amatera Stealer from a WebDAV share without ever writing to disk. #infosec #cybersecurity
captechgroup.com
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Steals Windows Passwords
Fake CAPTCHA, one clipboard paste into the Run dialog, and WordlistLoader delivers Amatera Stealer from a WebDAV share without ever writing to disk. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 22/08/2026
Kaspersky found proxy botnet malware delivered to Android car head units through the vendor's own update channel: no user action, no app icon, and your depot Wi-Fi SSID sent straight to the operators. #infosec #cybersecurity
captechgroup.com
Proxy Botnet Malware Infects Android Car Head Units in MoYu Campaign
Kaspersky found proxy botnet malware delivered to Android car head units through the vendor's own update channel: no user action, no app icon, and your depot Wi-Fi SSID sent straight to the operators. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 22/08/2026
Operation ASTERIX validated 43,066 crypto exchange accounts from 316,002 German phone numbers, then a branded email and matching phone call steered victims into fake Trezor Suite apps that stole BIP39 seed phrases. #infosec #cybersecurity
captechgroup.com
Operation ASTERIX Crypto Fraud Pipeline Analyzed Stage by Stage
Operation ASTERIX validated 43,066 crypto exchange accounts from 316,002 German phone numbers, then a branded email and matching phone call steered victims into fake Trezor Suite apps that stole BIP39 seed phrases. #infosec #cybersecurity
000
Capstone Technologies Group @captechgroup.com · 22/08/2026
Fake Shopify order alerts are arriving through Shopify's real infrastructure. No spoofed domain, no link, no attachment — just a callback number that ends with ScreenConnect installed and your bank session open. #infosec #cybersecurity
captechgroup.com
Fake Refund Scam Hits Shopify Shop App Users With AnyDesk and ScreenConnect
Fake Shopify order alerts are arriving through Shopify's real infrastructure. No spoofed domain, no link, no attachment — just a callback number that ends with ScreenConnect installed and your bank session open. #infosec #cybersecurity
000